Machine-Level Programming I: Basics

(1)

1

Machine-Level Programming I: Basics

15-213/18-213: Introduction to Computer Systems 5th _{Lecture, May 25, 2016}

Instructor:

(2)

2

Today: Machine Programming I: Basics



History of Intel processors and architectures



Assembly Basics: Registers, operands, move



Arithmetic & logical operations

(3)

3

Intel x86 Processors



Dominate laptop/desktop/server market



Evolutionary design



Backwards compatible up until 8086, introduced in 1978



Added more features as time goes on



Complex instruction set computer (CISC)



Many different instructions with many different formats

 _{But, only small subset encountered with Linux programs}



Hard to match performance of Reduced Instruction Set Computers (RISC)



But, Intel has done just that!

(4)

4

Intel x86 Evolution: Milestones

Name

Date

Transistors

MHz



8086

1978

29K

5-10



First 16-bit Intel processor. Basis for IBM PC & DOS



1MB address space



386

1985

275K

16-33



First 32 bit Intel processor , referred to as IA32



Added “flat addressing”, capable of running Unix



Pentium 4E

2004

125M

2800-3800



First 64-bit Intel x86 processor, referred to as x86-64



Core 2

2006

291M

1060-3500



First multi-core Intel processor



Core i7

2008

731M

1700-3900

(5)

5

Intel x86 Processors, cont.



Machine Evolution



386 1985 0.3M



Pentium 1993 3.1M



Pentium/MMX 1997 4.5M



PentiumPro 1995 6.5M



Pentium III 1999 8.2M



Pentium 4 2001 42M



Core 2 Duo 2006 291M



Core i7 2008 731M 

Added Features



Instructions to support multimedia operations



Instructions to enable more efficient conditional operations



Transition from 32 bits to 64 bits

(6)

6

2015 State of the Art



Core i7 Broadwell 2015 

Desktop Model



4 cores



Integrated graphics



3.3-3.8 GHz



65W 

Server Model



8 cores



Integrated I/O



2-2.6 GHz



45W

(7)

7

x86 Clones: Advanced Micro Devices

(AMD)



Historically



AMD has followed just behind Intel



A little bit slower, a lot cheaper



Then



Recruited top circuit designers from Digital Equipment Corp. and other downward trending companies



Built Opteron: tough competitor to Pentium 4



Developed x86-64, their own extension to 64 bits



Recent Years



Intel got its act together

 _{Leads the world in semiconductor technology}



AMD has fallen behind

(8)

8

Intel’s 64-Bit History



2001: Intel Attempts Radical Shift from IA32 to IA64



Totally different architecture (Itanium)



Executes IA32 code only as legacy



Performance disappointing



2003: AMD Steps in with Evolutionary Solution



x86-64 (now called “AMD64”)



Intel Felt Obligated to Focus on IA64



Hard to admit mistake or that AMD is better



2004: Intel Announces EM64T extension to IA32



Extended Memory 64-bit Technology



Almost identical to x86-64!



All but low-end x86 processors support x86-64

(9)

9

Our Coverage



IA32



The traditional x86



For 15/18-213: RIP, Summer 2015



x86-64



The standard



shark> gcc hello.c



shark> gcc –m64 hello.c 

Presentation



Book covers x86-64



Web aside on IA32

(10)

10

Today: Machine Programming I: Basics



Assembly Basics: Registers, operands, move



(11)

11

Levels of Abstraction

C programmer Assembly programmer Computer Designer

C code

$

Caches, clock freq, layout, …

Nice clean layers, but beware…

Of course, you know that:

It is why you are taking

(12)

12

Definitions



Architecture:

(also ISA: instruction set architecture) The

parts of a processor design that one needs to understand

for write assembly/machine code.



Examples: instruction set specification, registers.



Microarchitecture:

Implementation of the architecture.



Examples: cache sizes and core frequency.



Code Forms:



Machine Code: The byte-level programs that a processor executes



Assembly Code: A text representation of machine code



Example ISAs:



Intel: x86, IA32, Itanium, x86-64

(13)

13

CPU

Assembly/Machine Code View

Programmer-Visible State



PC: Program counter

 Address of next instruction  Called “RIP” (x86-64)



Register file

 Heavily used program data



Condition codes

 Store status information about most recent arithmetic or logical operation  Used for conditional branching

PC

Registers

Memory

Code Data Stack Addresses Data Instructions Condition Codes



Memory

 Byte addressable array  Code and user data

(14)

14

Assembly Characteristics: Data Types



“Integer” data of 1, 2, 4, or 8 bytes



Data values



Addresses (untyped pointers)



Floating point data of 4, 8, or 10 bytes



Code: Byte sequences encoding series of instructions



No aggregate types such as arrays or structures

(15)

15

%rsp

x86-64 Integer Registers



Can reference low-order 4 bytes (also low-order 1 & 2 bytes)

%eax %ebx %ecx %edx %esi %edi %esp %ebp %r8d %r9d %r10d %r11d %r12d %r13d %r14d %r15d

%r8

%r9

%r10

%r11

%r12

%r13

%r14

%r15

%rax

%rbx

%rcx

%rdx

%rsi

%rdi

%rbp

(16)

16

Some History: IA32 Registers

%eax

%ecx

%edx

%ebx

%esi

%edi

%esp

%ebp

%ax %cx %dx %bx %si %di %sp %bp %ah %ch %dh %bh %al %cl %dl %bl

16-bit virtual registers (backwards compatibility) gen er al pu rpos e accumulate counter data base source index destination index stack pointer base pointer Origin (mostly obsolete)

(17)

17

Assembly Characteristics: Operations



Transfer data between memory and register



Load data from memory into register



Store register data into memory



Perform arithmetic function on register or memory data



Transfer control



Unconditional jumps to/from procedures

(18)

18

Moving Data



Moving Data

movq Source, Dest:



Operand Types



Immediate: Constant integer data

 _Example:$0x400_,$-533

 _{Like C constant, but prefixed with}‘$’  _{Encoded with 1, 2, or 4 bytes}



Register: One of 16 integer registers

 Example: %rax, %r13

 _But%rsp _{reserved for special use}

 _{Others have special uses for particular instructions}



Memory: 8 consecutive bytes of memory at address given by register

 _{Simplest example:}(%rax)  _{Various other “address modes”}

%rax

%rcx

%rdx

%rbx

%rsi

%rdi

%rsp

%rbp

%rN

(19)

19

Moving Data



Moving Data

movq Source, Dest:



Operand Types



Immediate: Constant integer data

 _Example:$0x400_,$-533

 _{Like C constant, but prefixed with}‘$’  _{Encoded with 1, 2, or 4 bytes}



Register: One of 16 integer registers

 Example: %rax, %r13

 _But%rsp _{reserved for special use}

 _{Others have special uses for particular instructions}



Memory: 8 consecutive bytes of memory at address given by register

 _{Simplest example:}(%rax)  _{Various other “address modes”}

%rax

%rcx

%rdx

%rbx

%rsi

%rdi

%rsp

%rbp

%rN

(20)

20

movq

Operand Combinations

Cannot do memory-memory transfer with a single instruction

movq

Imm

Reg

Mem

Reg

Mem

Reg

Mem

Reg

Source

Dest

C Analog

movq $0x4,%rax temp = 0x4; movq $-147,(%rax) *p = -147;

movq %rax,%rdx temp2 = temp1; movq %rax,(%rdx) *p = temp;

movq (%rax),%rdx temp = *p;

(21)

21

Simple Memory Addressing Modes



Normal

(R)

Mem[Reg[R]]



Register R specifies memory address



Aha! Pointer dereferencing in C

movq (%rcx),%rax



Displacement

D(R)

Mem[Reg[R]+D]



Register R specifies start of memory region



Constant displacement D specifies offset

(22)

22

Example of Simple Addressing Modes

whatAmI:

movq (%rdi), %rax movq (%rsi), %rdx movq %rdx, (%rdi) movq %rax, (%rsi) ret void whatAmI(<type> a, <type> b) { ???? } %rdi %rsi

(23)

23

Example of Simple Addressing Modes

void swap

(long *xp, long *yp) { long t0 = *xp; long t1 = *yp; *xp = t1; *yp = t0; } swap:

movq (%rdi), %rax movq (%rsi), %rdx movq %rdx, (%rdi) movq %rax, (%rsi) ret

(24)

24 %rdi %rsi %rax %rdx

Understanding

Swap

()

void swap

(long xp, long yp) { long t0 = xp; long t1 = yp; xp = t1; yp = t0; }

Memory

Register Value %rdi xp %rsi yp %rax t0 %rdx t1 swap:

movq (%rdi), %rax # t0 = xp movq (%rsi), %rdx # t1 = yp movq %rdx, (%rdi) # xp = t1 movq %rax, (%rsi) # yp = t0 ret

(25)

25

Understanding

Swap

()

123 456 %rdi %rsi %rax %rdx 0x120 0x100

Registers

Memory

swap:

movq (%rdi), %rax # t0 = xp movq (%rsi), %rdx # t1 = yp movq %rdx, (%rdi) # xp = t1 movq %rax, (%rsi) # yp = t0 ret 0x120 0x118 0x110 0x108 0x100 Address

(26)

26

Understanding

Swap

()

123 456 %rdi %rsi %rax %rdx 0x120 0x100 123

Registers

Memory

swap:

movq (%rdi), %rax # t0 = *xp

movq (%rsi), %rdx # t1 = *yp movq %rdx, (%rdi) # *xp = t1 movq %rax, (%rsi) # *yp = t0 ret 0x120 0x118 0x110 0x108 0x100 Address

(27)

27

Understanding

Swap

()

123 456 %rdi %rsi %rax %rdx 0x120 0x100 123 456

Registers

Memory

swap:

movq (%rdi), %rax # t0 = *xp

movq (%rsi), %rdx # t1 = *yp

movq %rdx, (%rdi) # *xp = t1 movq %rax, (%rsi) # *yp = t0 ret 0x120 0x118 0x110 0x108 0x100 Address

(28)

28

Understanding

Swap

()

456 456 %rdi %rsi %rax %rdx 0x120 0x100 123 456

Registers

Memory

swap:

movq (%rdi), %rax # t0 = xp movq (%rsi), %rdx # t1 = yp

movq %rdx, (%rdi) # *xp = t1

movq %rax, (%rsi) # *yp = t0 ret 0x120 0x118 0x110 0x108 0x100 Address

(29)

29

Understanding

Swap

()

456 123 %rdi %rsi %rax %rdx 0x120 0x100 123 456

Registers

Memory

swap:

movq (%rdi), %rax # t0 = xp movq (%rsi), %rdx # t1 = yp movq %rdx, (%rdi) # *xp = t1

movq %rax, (%rsi) # *yp = t0

ret 0x120 0x118 0x110 0x108 0x100 Address

(30)

30

Simple Memory Addressing Modes



Normal

(R)

Mem[Reg[R]]



Register R specifies memory address



Aha! Pointer dereferencing in C

movq (%rcx),%rax



Displacement

D(R)

Mem[Reg[R]+D]



Register R specifies start of memory region



Constant displacement D specifies offset

(31)

31

Complete Memory Addressing Modes



Most General Form

D(Rb,Ri,S)

Mem[Reg[Rb]+S*Reg[Ri]+ D]



D: Constant “displacement” 1, 2, or 4 bytes



Rb: Base register: Any of 16 integer registers



Ri: Index register: Any, except for %rsp



S: Scale: 1, 2, 4, or 8 (why these numbers?)



Special Cases

(Rb,Ri)

Mem[Reg[Rb]+Reg[Ri]]

D(Rb,Ri)

Mem[Reg[Rb]+Reg[Ri]+D]

(Rb,Ri,S)

Mem[Reg[Rb]+S*Reg[Ri]]

(32)

32

Expression Address Computation Address

0x8(%rdx) (%rdx,%rcx) (%rdx,%rcx,4) 0x80(,%rdx,2)

Address Computation Examples

Expression Address Computation Address

0x8(%rdx) 0xf000 + 0x8 0xf008 (%rdx,%rcx) 0xf000 + 0x100 0xf100 (%rdx,%rcx,4) 0xf000 + 4*0x100 0xf400 0x80(,%rdx,2) 2*0xf000 + 0x80 0x1e080 %rdx 0xf000 %rcx 0x0100

(33)

33

Today: Machine Programming I: Basics



(34)

34

Address Computation Instruction



leaq

Src

,

Dst



Src is address mode expression



Set Dst to address denoted by expression



Uses



Computing addresses without a memory reference

 _{E.g., translation of}p = &x[i];



Computing arithmetic expressions of the form x + k*y

 _{k = 1, 2, 4, or 8}



Example

long m12(long x) {

return x*12;

} leaq (%rdi,%rdi,2), %rax # t <- x+x*2_{salq $2, %rax} _{# return t<<2}

(35)

35

Some Arithmetic Operations



Two Operand Instructions:

Format Computation

addq Src,Dest Dest = Dest + Src

subq Src,Dest Dest = Dest  Src

imulq Src,Dest Dest = Dest * Src

salq Src,Dest Dest = Dest << Src Also called shlq

sarq Src,Dest Dest = Dest >> Src Arithmetic

shrq Src,Dest Dest = Dest >> Src Logical

xorq Src,Dest Dest = Dest ^ Src

andq Src,Dest Dest = Dest & Src

orq Src,Dest Dest = Dest | Src



Watch out for argument order!

(36)

36

Some Arithmetic Operations



One Operand Instructions

incq Dest Dest = Dest + 1 decq Dest Dest = Dest  1 negq Dest Dest =  Dest notq Dest Dest = ~Dest

(37)

37

Arithmetic Expression Example

Interesting Instructions



leaq: address computation



salq: shift



imulq: multiplication

 _{But, only used once}

long arith

(long x, long y, long z) { long t1 = x+y; long t2 = z+t1; long t3 = x+4; long t4 = y * 48; long t5 = t3 + t4; long rval = t2 * t5; return rval; } arith:

leaq (%rdi,%rsi), %rax

addq %rdx, %rax leaq (%rsi,%rsi,2), %rdx salq $4, %rdx leaq 4(%rdi,%rdx), %rcx imulq %rcx, %rax ret

(38)

38

Understanding Arithmetic Expression

Example

long arith

(long x, long y, long z) { long t1 = x+y; long t2 = z+t1; long t3 = x+4; long t4 = y * 48; long t5 = t3 + t4; long rval = t2 * t5; return rval; } arith:

leaq (%rdi,%rsi), %rax # t1

addq %rdx, %rax # t2

leaq (%rsi,%rsi,2), %rdx

salq $4, %rdx # t4

leaq 4(%rdi,%rdx), %rcx # t5

imulq %rcx, %rax # rval

ret Register Use(s) %rdi Argument x %rsi Argument y %rdx Argument z %rax t1, t2, rval %rdx t4 %rcx t5

(39)

39

Today: Machine Programming I: Basics



(40)

40

text

binary

Compiler (gcc –Og -S) Assembler (gcc or as) Linker (gcc or ld) C program (p1.c p2.c) Asm program (p1.s p2.s)

Object program (p1.o p2.o)

Executable program (p)

Static libraries (.a)

Turning C into Object Code



Code in files p1.c p2.c



Compile with command: gcc –Og p1.c p2.c -o p

 _{Use basic optimizations (}-Og_{) [New to recent versions of GCC]}  _{Put resulting binary in file}p

(41)

41

Compiling Into Assembly

C Code (sum.c)

long plus(long x, long y); void sumstore(long x, long y,

long *dest) {

long t = plus(x, y); *dest = t; }

Generated x86-64 Assembly

sumstore: pushq %rbx movq %rdx, %rbx call plus movq %rax, (%rbx) popq %rbx ret

Obtain (on shark machine) with command

gcc

–

Og

–

S sum.c

Produces file

sum.s

Warning: Will get very different results on non-Shark

machines (Andrew Linux, Mac OS-X, …) due to different

versions of gcc and different compiler settings.

(42)

42

What it really looks like

.globl sumstore

.type sumstore, @function sumstore: .LFB35: .cfi_startproc pushq %rbx .cfi_def_cfa_offset 16 .cfi_offset 3, -16 movq %rdx, %rbx call plus movq %rax, (%rbx) popq %rbx .cfi_def_cfa_offset 8 ret .cfi_endproc .LFE35:

(43)

43

What it really looks like

.globl sumstore

.type sumstore, @function

sumstore: .LFB35: .cfi_startproc pushq %rbx .cfi_def_cfa_offset 16 .cfi_offset 3, -16 movq %rdx, %rbx call plus movq %rax, (%rbx) popq %rbx .cfi_def_cfa_offset 8 ret .cfi_endproc .LFE35:

.size sumstore, .-sumstore

Things that look weird

and are preceded by a ‘.’

are generally directives.

sumstore: pushq %rbx movq %rdx, %rbx call plus movq %rax, (%rbx) popq %rbx ret

(44)

44

Assembly Characteristics: Data Types



“Integer” data of 1, 2, 4, or 8 bytes



Data values



Addresses (untyped pointers)



Floating point data of 4, 8, or 10 bytes



Code: Byte sequences encoding series of instructions



No aggregate types such as arrays or structures

(45)

45

Assembly Characteristics: Operations



Transfer data between memory and register



Load data from memory into register



Store register data into memory



Perform arithmetic function on register or memory data



Transfer control



Unconditional jumps to/from procedures

(46)

46

Code for

sumstore

0x0400595: 0x53 0x48 0x89 0xd3 0xe8 0xf2 0xff 0xff 0xff 0x48 0x89 0x03 0x5b 0xc3

Object Code



Assembler



Translates .s into .o



Binary encoding of each instruction



Nearly-complete image of executable code



Missing linkages between code in different files



Linker



Resolves references between files



Combines with static run-time libraries

 _{E.g., code for}malloc_,printf



Some libraries are dynamically linked

 _{Linking occurs when program begins}

execution • Total of 14 bytes • Each instruction 1, 3, or 5 bytes • Starts at address 0x0400595

(47)

47

Machine Instruction Example



C Code



Store value t where designated by

dest



Assembly



Move 8-byte value to memory

 _{Quad words in x86-64 parlance}



Operands: t: Register %rax dest: Register %rbx *dest: Memory M[%rbx] 

Object Code



3-byte instruction



Stored at address 0x40059e

*dest = t;

movq %rax, (%rbx)

(48)

48

Disassembled

Disassembling Object Code



Disassembler

objdump –d sum



Useful tool for examining object code



Analyzes bit pattern of series of instructions



Produces approximate rendition of assembly code



Can be run on either a.out (complete executable) or .o file

0000000000400595 <sumstore>:

400595: 53 push %rbx

400596: 48 89 d3 mov %rdx,%rbx

400599: e8 f2 ff ff ff callq 400590 <plus>

40059e: 48 89 03 mov %rax,(%rbx)

4005a1: 5b pop %rbx 4005a2: c3 retq

(49)

49

Disassembled

Dump of assembler code for function sumstore: 0x0000000000400595 <+0>: push %rbx

0x0000000000400596 <+1>: mov %rdx,%rbx

0x0000000000400599 <+4>: callq 0x400590 <plus>

0x000000000040059e <+9>: mov %rax,(%rbx)

0x00000000004005a1 <+12>:pop %rbx 0x00000000004005a2 <+13>:retq

Alternate Disassembly



Within gdb Debugger



Disassemble procedure gdb sum disassemble sumstore

(50)

50

Disassembled

Dump of assembler code for function sumstore: 0x0000000000400595 <+0>: push %rbx

0x0000000000400596 <+1>: mov %rdx,%rbx

0x0000000000400599 <+4>: callq 0x400590 <plus>

0x000000000040059e <+9>: mov %rax,(%rbx)

0x00000000004005a1 <+12>:pop %rbx 0x00000000004005a2 <+13>:retq

Alternate Disassembly



Within gdb Debugger



Disassemble procedure gdb sum disassemble sumstore



Examine the 14 bytes starting at sumstore

x/14xb sumstore

Object

0x0400595: 0x53 0x48 0x89 0xd3 0xe8 0xf2 0xff 0xff 0xff 0x48 0x89 0x03 0x5b 0xc3

(51)

51

What Can be Disassembled?



Anything that can be interpreted as executable code



Disassembler examines bytes and reconstructs assembly source

% objdump -d WINWORD.EXE

WINWORD.EXE: file format pei-i386 No symbols in "WINWORD.EXE".

Disassembly of section .text: 30001000 <.text>: 30001000: 55 push %ebp 30001001: 8b ec mov %esp,%ebp 30001003: 6a ff push $0xffffffff 30001005: 68 90 10 00 30 push $0x30001090 3000100a: 68 91 dc 4c 30 push $0x304cdc91

Reverse engineering forbidden by

Microsoft End User License Agreement

(52)

52

Machine Programming I: Summary





Evolutionary design leads to many quirks and artifacts



C, assembly, machine code



New forms of visible state: program counter, registers, ...



Compiler must transform statements, expressions, procedures into low-level instruction sequences





The x86-64 move instructions cover wide range of data movement forms



Arithmetic



C compiler will figure out different instruction combinations to carry out computation

Machine-Level Programming I: Basics